Frontend PR Review Checklist v1 (MC #106089)

Frontend PR Review Checklist v1

Source spec: ~/system/docs/published/alai-frontend-engineering-spec-v1-106089.md
MC: #106089
Applies to: Every ALAI product frontend PR.

Reviewer may mark an item N/A only with a reason.

Build and dependency discipline

Lockfile changed only when dependency change is intentional.
Dependency install in CI uses frozen lockfile / npm ci.
tsc passes.
Lint passes.
Production framework build passes (next build).
No invalid App Router page/layout exports.

Runtime UX

Loading, empty, error, and retry states are implemented for every async area touched.
Buttons/links clicked in tests have observable outcomes.
Mutations prevent duplicate unsafe submission.
Error copy is human-readable and does not expose stack traces.

Auth/session

Auth redirect/session flow tested on public/custom domain.
Hard navigation to protected deep link remains authenticated after login.
Logout clears client and server session state.
Cookie attributes are correct for the deployed domain strategy.

Cache/versioning

Build metadata is present and no-store.
Version-skew detection exists for long-lived shells or is tracked as explicit product debt.
HTML no-store/revalidate and chunks immutable headers verified on deployed/public URL.

i18n/a11y/security

No new hardcoded user-visible strings in multi-language products.
Locale-aware date/amount formatting used.
Keyboard navigation and focus states remain valid.
CSP/security headers are not weakened.
Third-party widget config uses allowed values and is tested.

Evidence

PR includes command output for typecheck/lint/build/tests.
PR includes browser evidence for user-facing changes.
Known browser console warnings are named; unexpected console errors fail.

Verdict format

Frontend Spec v1 review: PASS | PARTIAL | BLOCKED
Build gate: pass/fail + command
Browser gate: pass/fail + URL/evidence
Auth/cache/CSP impacted: yes/no
Required follow-ups before merge/promote: ...